iovisor / iovisor/bcc

How to determine in filter(struct __sk_buff *skb) if there is an ethernet header

Open
#2,589 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I'm building a pcap filter which uses the 'filter' function to determine if a packet should be sent to user space. This works fine if I attach it to an ethernet interface. If I attach the same function to a GRE interface, then it doesn't work as the packet that arrives doesn't have an ethernet header on it.

I can't figure out from the fields in the __sk_buff whether there is a way of telling if there is an ethernet header or not. Any ideas? All the examples seem to assume that there is an ethernet header.

My fallback is to get the interface type and specifically check for GRE.... But this doesn't seem scalable.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the filter function and the __sk_buff fields referenced in the report, then compare packet layouts on Ethernet and GRE interfaces. Check whether existing examples or documentation explain how to distinguish the headers without interface-specific checks; done means the determination path or limitation is clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
networking, operating-systems
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.